About mcpprobe
AI agents are getting the keys. We test the locks.
mcpprobe is a small, independent UK company building security testing for MCP servers, the connectors that let AI assistants and agents use your tools and data. We started it because these servers were being shipped faster than anyone was testing them.
Our mission
Make it normal to test an MCP server before an AI agent is allowed to use it, and to show the evidence.
Why we built it
A note from the founder.
I have spent my career on the defending side of security: investigating incidents, writing detections, and explaining findings to the people who have to fix them. When MCP arrived, I watched teams connect AI agents to email, code and databases through servers nobody had tested, and saw the first public incidents follow: tool descriptions that hijack the agent, servers that answer anyone, a package that quietly copied every email it sent. The existing tools either read config files or tested prompts. None of them talked to the live server the way an attacker would and showed the proof. So I built one, made the core open source, and wrote down the rules it follows before writing the code that follows them.
How we work
Four rules we hold ourselves to.
- Evidence over claims
- Every finding shows the request and the response. If we cannot prove it, we say how confident we are.
- Open by default
- The scanner is open source. The checks catalogue, the scanning policy and our false-positive rates are public.
- Permission first
- We only test servers whose owner has proven control, and we check for an opt-out before the first request.
- Small and direct
- You will talk to the person who wrote the check. Security reports are acknowledged within two business days.
What we will never do
Promises, each backed by a policy.
- Scan a server whose owner has not verified it, including “teaser” scans of public registry listings.Scanning policy
- Name an unpatched server in research or marketing.Disclosure policy
- Sell your data, publish your scan results, or send your tool descriptions to an AI model without your opt-in.Security
- Show logos, testimonials or numbers we cannot back up.Design partners
- Claim a certification we do not hold.Trust centre
- Lock the open-source CLI behind an account.Pricing
Where we are now
Launch stage, shipping in public.
Version 0.1.0 of the CLI shipped on with 16 read-only checks. Deeper tests that call tools, with your permission, are next. Hosted scanning is planned for mid-November 2026; the CLI and the GitHub Action are available today.
We have no customers to quote yet. If you run or connect MCP servers and want a say in what we build next, become a design partner.
Company details
Who you are dealing with.
- Trading name
- mcpprobe
- Company
- ORGANIC VILLAGE(UK) LIMITED, a private limited company
- Registered in
- England and Wales
- Company number
- 11783758
- Hosted data
- Processed in London, United Kingdom (AWS eu-west-2)
Contact
Write to the right inbox.
- General
- hello@mcpprobe.techQuestions, plans, design partners, press
- Security
- security@mcpprobe.techVulnerabilities in mcpprobe. Acknowledged within 2 business days. Disclosure policy
- Abuse and opt-out
- abuse@mcpprobe.techUnwanted scanner traffic. You can also opt out without an account
- Bugs
- GitHub issuesFor problems with the CLI or the GitHub Action
See what we do before you decide whether to trust us.
The CLI is free and open source. Run it against a server you own, read the evidence, and judge for yourself.